Description
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | glib2 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Fedora | Extra Packages for Enterprise Linux | — | — |
| Fedora | Fedora 37 | — | — |
| Fedora | Fedora 38 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.74.4-1 | — |
| Debian 13 | glib2.0 | 2.74.4-1 | — |
| Debian 12 | glib2.0 | 2.74.4-1 | — |
| Debian 10 | glib2.0 | 2.58.3-2+deb10u5 | DLA-3583-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | glib2.0 | 2.72.4-0ubuntu2.2 | USN-6165-1 |
| Ubuntu 20.04 LTS | glib2.0 | 2.64.6-1~ubuntu20.04.6 | USN-6165-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glib2.0 | 2.56.4-0ubuntu0.18.04.9+esm3 | USN-6165-2 |
| Ubuntu Pro 16.04 LTS | glib2.0 | 2.48.2-0ubuntu4.8+esm3 | USN-6165-2 |
| Ubuntu Pro 14.04 LTS | glib2.0 | 2.40.2-0ubuntu1.1+esm6 | USN-6165-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | glib2 +4 | 2.68.4-11.el9 | RHSA-2023:6631 |
| RHEL 9 | mingw-glib2 +4 | 2.78.0-1.el9 | RHSA-2024:2528 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | glib2 +4 | 2.68.4-11.el9 | ALSA-2023:6631 |
| AlmaLinux 9 | mingw32-glib2 +3 | 2.78.0-1.el9 | ALSA-2024:2528 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
| SLE HPC 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
| SUSE Enterprise Storage 6 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | glib2 +4 | 2.74.7-688.amzn2023.0.1 | ALAS2023-2023-225 |
| Amazon Linux 2 | glib2 +5 | 2.56.1-9.amzn2.0.9 | ALAS2-2025-2767 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | glib | 2.71.0-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | glib2 +4 | 2.68.4-11.el9 | ELSA-2023-6631 |
| Oracle Linux 9 | mingw32-glib2 +3 | 2.78.0-1.el9 | ELSA-2024-2528 |
Advisories 19
- WID-SEC-2023-2853 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2023:6631 Low: glib2 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2528 Low: mingw-glib2 security update AlmaLinux Security Advisories · Oct 29, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- RHSA-2024:2528 Red Hat Security Advisory: mingw-glib2 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2023:6631 Red Hat Security Advisory: glib2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- USN-6165-2 glib2.0 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-6165-1 glib2.0 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-3583-1 glib2.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:3535-1 Security update for glib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- WID-SEC-2024-1437 Dell integrated Dell Remote Access Controller: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 7, 2025
- ALAS2-2025-2767 Important: glib2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 25, 2025
- ELSA-2024-2528 Low: mingw-glib2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 3, 2024
- ELSA-2023-6631 Low: glib2 security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- WID-SEC-2023-2825 NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 5, 2023
- ALAS2023-2023-225 Moderate: glib2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 27, 2023
References
- https://access.redhat.com/security/cve/CVE-2023-29499 vdb-entry
- RHBZ#2211828 issue-tracking
- https://gitlab.gnome.org/GNOME/glib/-/issues/2794
- https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html
- https://security.netapp.com/advisory/ntap-20231103-0001/
- https://security.gentoo.org/glsa/202311-18